ANSPDCP Breach Notification: When, How and What to Expect

A data breach does not necessarily mean a movie-style attack. Most of the time it is something mundane: an email sent to the wrong person, a lost laptop, a file accessed by someone who should not have. The good news is that the law does not punish you for having an incident, it punishes you for not responding properly. And the proper response has clear steps.

First, what a data breach is

It is any situation where personal data ends up where it should not, is lost, altered or no longer available. Three kinds, in short:

• Leak — data reaches someone not allowed to see it (a wrong email, a list published by mistake).
• Loss — you can no longer access the data (an attack that encrypts it, a lost USB stick, an accidental deletion).
• Alteration — data is changed without authorisation and is no longer correct.

When you are required to notify

The rule comes from Article 33 of the GDPR and is simpler than it sounds. You look at one thing: can the breach harm people?

• If yes (there is a risk to their rights and freedoms), you notify ANSPDCP without undue delay and, where feasible, within 72 hours of becoming aware.
• If the risk is unlikely (for example, the leaked data was properly encrypted and no one can read it), you may skip notification. But be careful: you must write down and keep the reason you decided so.

Whatever you decide, every breach goes into an internal incident register. It is proof you treated things seriously, and the authority can ask for it at any time.

When the 72 hours start

Not from when the breach happened, but from when you became aware of it with reasonable certainty. Important to know: the clock runs continuously, including weekends and holidays. That is exactly why it is best to have a plan in advance, rather than inventing one on a Saturday night.

If you cannot make it within 72 hours, you still send the notification, but you add the reason for the delay. A late but honest notification is far better than silence.

How to file the notification, concretely

In Romania, the notification is made through the breach notification form on the authority's website, dataprotection.ro. The law requires the notification to include, in plain terms:

• What happened — the nature of the breach, which categories of data and roughly how many people and records are affected.
• Who can be contacted — the contact details of the Data Protection Officer (DPO) or the person handling it.
• The likely consequences — what the affected people are at risk of.
• What you did — the measures taken to stop the breach and limit its effects.

You do not need all the perfect answers from the start. If you are still investigating within 72 hours, you send what you know now and come back with the rest in phases. That is perfectly accepted.

When you also inform the affected people

Besides the authority, sometimes you also have to inform the people whose data was affected. This comes from Article 34 and applies when the breach can pose a high risk to them: fraud, identity theft, exposure of sensitive data.

The message to people has to be clear, not a legal text. You tell them what happened, what data is involved and what they can do to protect themselves (for example, change a password or watch out for suspicious messages). If the data was encrypted or you have since taken measures that make the risk unlikely, individual notice may no longer be needed.

What to expect afterwards

Once you send the notification, things can go several ways.

• Confirmation. You receive a confirmation and a registration number. Keep it.
• Clarifications. The authority may come back with questions or ask for extra documents.
• Investigation or inspection. In more serious cases, a review of how you protected the data may be opened.
• The final decision. It may take no action, order remediation measures or, in serious cases, impose a fine.

Here, how you behaved matters enormously: a timely, honest notification, with measures already taken and an orderly record of the incident, weighs strongly in your favour. Panic and hiding do exactly the opposite.

How we help

The calmest companies during a breach are not the ones that never make mistakes, but the ones that know in advance who does what in the first hours. At INFOSHARE we prepare an incident response plan, the breach register and the notification texts together, and if a real incident happens, we walk you through the whole process. See our GDPR services, the outsourced DPO role and the article on a real incident with data in an Excel file. Everything about registers and records sits in one place, in the askGDPR platform.

Frequently asked questions